Research project

CAIRN: Causal Active Inference for cyber attack diagnosis.

CAIRN explores how causal evidence graphs, Bayesian inference, and active interventions can help diagnose attacks when passive security telemetry is ambiguous.

DOI 10.1145/3779208.3804893Download BibTeX
VenueACM AsiaCCS '26 poster paper
Pages1919-1921
StatusPeer-reviewed publication

Authors: Sayan Mondal, Avijit Gayen, and Angshuman Jana.

Methodology

Infer first, intervene when evidence is insufficient.

Core method
  • Represent security telemetry as a causal evidence graph.
  • Run Bayesian inference over competing attack explanations.
  • Select low-risk interventions when passive observations cannot distinguish likely causes.
  • Use discriminative observations to update attack diagnosis and response confidence.
Why it matters

Correlation-heavy IDS and SIEM workflows can overload analysts with alerts while leaving causal uncertainty unresolved. CAIRN adds an infer-and-verify loop to make response decisions more explainable.

Architecture diagram

CAIRN diagnosis and response loop

Enterprise telemetryEvidence graphBayesian diagnosisIntervention selectorFocused probe / logging / decoyUpdated response decision

Datasets and evaluation

Telemetry-driven testbed evaluation.

Dataset context

The evaluation uses the CTI-HAL threat-intelligence corpus, described in the paper as 57 reported attacks from 7 major threat-actor groups with 3,677 extracted entity instances. The split reserves 70% for evidence-graph modeling and 30% for validation/testing.

Results summary

In the reported testbed, CAIRN reaches 0.937 precision, 0.951 recall, 0.944 F1, 6.24 mean time-to-confirmation, and 43 total false positives, outperforming the TF-IDF and sentence-embedding IDS baselines shown in the paper.